updll3.dlz
- SHA256 7448456f9a3d7d68f7137ea5e7c6ae21d615a7415884b8ca434b20bfc6c18b66
Static task
static1
Behavioral task
behavioral1
Sample
updll3.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
updll3.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target updll3.dlz
- Size 999KB
- Sample261014-pjs63svvbw
- SHA256 7448456f9a3d7d68f7137ea5e7c6ae21d615a7415884b8ca434b20bfc6c18b66
- MD5 0abf7b4d09d5b2d6eb879b280598e48d
- SHA1 afce40ca294b6ceab088a9cf1422a72781b19066
- SHA512 3b0401108e6abb8b0ec7324bd5ef1045b1f992995dee4174fc6759d53b43a1351a5a75201fafa6af2949c68b6b8fabfcd9c7e3c6bed7eb4329eb46cfd4566b75
- SSDEEP 24576:UlkzdtEEYtqRH8Hv0cFiAoo2g0+4qLTJ0S5ya9eCUE3p9CAB:UcbjLRAvLWMnN0U3eCUiz7B
- TLSH T19F2533C574330B2A22BC85F56E7295ADF3301E8B006740DB6BE2C63E994A60DED572D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
updll3.dlz.zip 999KB
-
updll3.dll3.dll 1015KB
updll3.dll3
- IMPHASH 9f51cba7d0a6acf52d662b6ceafde4d3
- SHA256 416309526deda096ac6b16949a61237b47100fa6854d74e3bfacaab3d8a4afb8
- MD5 f5e3fd1d3a5e86fc072d53408e758be9
- SHA1 1ed2958aa8bc966881a38ae54cc323e5bc52ec28
- SHA512 4674f601c78c317afdb324cb9e48df2e1e93e3cd061f4d36aa782109d9060fed841f153836852db93bcc3fb84b08ec4f1c35fccea392de248ca89729a4c850c7
- SSDEEP 24576:HzQzdHcEotQ5HCHvwcFi+ooSgA+eqLTJAS5IwX+CmE3l9CA0L3i+:H6Rrv5avfiupNAUz+CmiH7+V
- TLSH T1E925339679354A16D27949F47DE0893EF7313E4A1522C0C3A6A2C21D8E8474EED4B2EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
09:8b:56:8b:fe:fb:00:20:b7:de:ba:2a:56:d5:16:94:95:6e:ad:0d:88:9d:da:01:5d:e4:8d:ef:34:85:ca:d6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=802191518,CN=eScan (Microworld Technologies Inc.),O=eScan (Microworld Technologies Inc.),ST=Michigan,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084d6963686967616e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 8, 2026
SERIALNUMBER=802191518,CN=eScan (Microworld Technologies Inc.),O=eScan (Microworld Technologies Inc.),ST=Michigan,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084d6963686967616e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
SERIALNUMBER=802191518,CN=eScan (Microworld Technologies Inc.),O=eScan (Microworld Technologies Inc.),ST=Michigan,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084d6963686967616e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Digest
00:f7:f4:bf:37:ba:b0:4c:18:d5:25:8d:c9:84:a3:03:3b:8c:21:41
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=802191518,CN=eScan (Microworld Technologies Inc.),O=eScan (Microworld Technologies Inc.),ST=Michigan,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084d6963686967616e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 8, 2026
SERIALNUMBER=802191518,CN=eScan (Microworld Technologies Inc.),O=eScan (Microworld Technologies Inc.),ST=Michigan,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084d6963686967616e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
SERIALNUMBER=802191518,CN=eScan (Microworld Technologies Inc.),O=eScan (Microworld Technologies Inc.),ST=Michigan,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084d6963686967616e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
Serial Number
33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
SERIALNUMBER=802191518,CN=eScan (Microworld Technologies Inc.),O=eScan (Microworld Technologies Inc.),ST=Michigan,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084d6963686967616e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
68:52:5d:ad:f7:0c:77:3d:41:60:9f:f7:ca:49:9f:b5
Issuer
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 29, 2024 - Jul 29, 2027
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US
Serial Number
08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 5, 2026 - Nov 4, 2037
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
5
Entry point
975749
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
ws2_32
WSAGetLastError
winhttp
WinHttpSetStatusCallback
user32
CloseWindowStation
advapi32
RegDeleteValueA
shell32
SHGetPathFromIDListA
ole32
CoCreateInstance
oleaut32
SysStringLen
UpgradeFiles
ValidateLibrary
Name
.text
Size
970KB
Virtual Size
2.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=8, productName=Unmarked objects (old),
count=5, id=132, productName=VS2008 build 21022, version=21022,
count=11, id=150, version=20413,
count=33, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=85, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=218, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=123, productName=VS2005 build 50727, version=50727,
count=503, id=1, productName=Unmarked objects,
count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=39, id=138, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,